News

Malaysia Delays Mandatory GHG Assurance to 2028: What NSRF Preparers Should Do With the Extra Year

R4XN TECHSep 23, 20265 min read33 views

Kuala Lumpur skyline with sustainability reporting charts for GHG Scope 1 and 2

Kuala Lumpur, mid-September 2026: Malaysia’s Advisory Committee on Sustainability Reporting (ACSR), chaired by the Securities Commission Malaysia (SC), deferred mandatory reasonable assurance on Scope 1 and Scope 2 greenhouse gas (GHG) emissions disclosures by one year.

For Group 1 entities under the National Sustainability Reporting Framework (NSRF), mandatory assurance now begins for annual reporting periods on or after 1 January 2028, not 1 January 2027. Group 2 moves to 2029 and Group 3 to 2030. The SC’s 17 September 2026 media release is the primary source; business press including The Edge Malaysia and Bernama carried matching summaries.

This is not a holiday from climate reporting. It is a quality-and-controls extension after early IFRS Sustainability Disclosure Standards reporting showed uneven readiness.

ACSR deferred mandatory Scope 1–2 GHG reasonable assurance to 2028 for Group 1—disclosure continues.

Why the delay happened

ACSR pointed to a review by the Minority Shareholders Watch Group (MSWG) and Climate Governance Malaysia (CGM) of the first cohort of 91 Group 1 listed issuers reporting under IFRS Sustainability Disclosure Standards. The review found disclosure quality still needed improvement before mandatory reasonable assurance would be meaningful.

In plain language: if the underlying meters, allocation methods, organisational boundaries, and control narratives are soft, an assurance opinion becomes theatre. The extra year is meant to let preparers harden processes, internal controls, and data quality—not to pause Scope 1 and 2 measurement.

What did not get paused

Listed issuers remain required under Main Market and ACE Market Listing Requirements to state whether sustainability disclosures were:

subject to internal review by internal auditors, or
independently assured by a sustainability assurance provider.

That transparency line stays live. Markets can still distinguish self-reviewed packs from independently assured ones.

Assurance standard choice also tightened. Independent assurance must now follow ISSA 5000 (International Standard on Sustainability Assurance 5000) only. ISAE 3000 (Revised) and ISO assurance routes are no longer recommended under the ACSR update. Teams mid-engagement on a non-ISSA pathway should speak with their assurance provider immediately.

New mandatory assurance clocks: Group 1 in 2028, Group 2 in 2029, Group 3 in 2030.

Who should treat this as urgent anyway

Group 1 preparers still have a hard clock: reporting periods beginning 1 January 2028. For a company with a December year-end, that means FY2028 data and a 2029 report cycle under mandatory reasonable assurance—close enough that control design in 2026–2027 is the real work.

Groups 2 and 3 gain a year too, but cascading supplier questionnaires from Group 1 will not wait for your group label. Banks, GLCs, and large listed customers will keep asking for Scope 1/2 quality upgrades because their assurance risk sits on your activity data.

Private suppliers and digital product firms that are not yet in NSRF scope should still care. Enterprise RFPs in Malaysia increasingly copy IFRS S2-style climate fields. A one-year regulatory deferral does not delete commercial diligence.

A practical “use the year” checklist

Freeze organisational and operational boundaries. Document equity share vs control approaches, leased assets, joint ventures, and which facilities sit inside Scope 1/2. Boundary churn is a classic assurance finding.
Replace spreadsheet heroics with systems of record. Utility invoices, fuel cards, refrigerant logs, and fleet telematics should feed a controlled calculation layer with versioned emission factors. Manual year-end reconstructions fail walkthroughs.
Separate estimation policy from measurement. Where meters are missing, write down the estimation method, owner, and phase-out plan. Auditors can live with disclosed estimates; they struggle with silent ones.
Run a dry-run limited review in 2027 even if not mandatory. A paid or internal pre-assurance rehearsal surfaces control gaps while remediation is still cheap.
Align to ISSA 5000 expectations early. Update engagement letters, evidence request lists, and management representation drafts so 2028 is not your first conversation about the standard.
Connect climate data to financial close. IFRS Sustainability Disclosure Standards expect connectivity with financial statements. Treat GHG as another close process with cut-off, completeness, and review sign-offs—not a CSR side project.

Use the extra year to harden meters, boundaries, and ISSA 5000-ready evidence—not to idle.

Regional context without the spin

Malaysia’s NSRF is part of a broader ASEAN move toward ISSB-aligned climate disclosure. Europe’s Omnibus simplification of ESRS/CSRD and the global rise of TNFD nature reporting show the same pattern: frameworks iterate, timelines slip for quality reasons, but investor and buyer demand does not reset to zero.

Technology teams watching mid-September’s AI model launches see a different industry’s version of the same discipline—verify primary announcements, measure your own workloads, and avoid rewriting production on day one. For that parallel in the AI stack, see GPT-6 Sol & Luna vs Claude Opus 5.5 pricing.

Bottom line

ACSR’s deferral to 2028 is a quality intervention, not a green light to idle. Keep disclosing Scope 1 and 2, say clearly whether reviews or assurance happened, migrate independent work to ISSA 5000, and spend 2026–2027 fixing boundaries, meters, and controls. The companies that waste the extra year will pay for it in rushed 2028 assurance findings and sceptical lenders.